BILLING CODE: 4810-AM-P BUREAU OF CONSUMER FINANCIAL PROTECTION 12 CFR Chapter X [Docket No. CFPB-2020-0034] RIN 3170-AA78 Consumer Access to Financial Records AGENCY: Bureau of Consumer Financial Protection. ACTION: Advance notice of proposed rulemaking. SUMMARY: Section 1033 of the Dodd-Frank Wall Street Reform and Consumer Protection Act (Dodd-Frank Act) provides, among other things, that subject to rules prescribed by the Bureau of Consumer Financial Protection (Bureau), a consumer financial services provider must make available to a consumer information in the control or possession of the provider concerning the consumer financial product or service that the consumer obtained from the provider. The Bureau is issuing this Advance Notice of Proposed Rulemaking (ANPR) to solicit comments and information to assist the Bureau in developing regulations to implement section 1033. DATES: Comments must be received on or before [INSERT DATE 90 DAYS AFTER DATE OF PUBLICATION IN THE FEDERAL REGISTER]. ADDRESSES: You may submit comments, identified by Docket No. CFPB-2020-0034 or RIN 3170-AA78, by any of the following methods: • Federal eRulemaking Portal: https://www.regulations.gov. Follow the instructions for submitting comments. • Email: [email protected]. Include Docket No. CFPB-2020-0034 or RIN 3170-AA78 in the subject line of the message. 1 • Mail/Hand Delivery/Courier: Comment Intake—Section 1033 ANPR, Bureau of Consumer Financial Protection, 1700 G Street NW, Washington, DC 20552. Instructions: The Bureau encourages the early submission of comments. All submissions should include the agency name and docket number or Regulatory Information Number (RIN) for this rulemaking. Because paper mail in the Washington, DC area and at the Bureau is subject to delay, and in light of difficulties associated with mail and hand deliveries during the COVID-19 pandemic, commenters are encouraged to submit comments electronically. In general, all comments received will be posted without change to https://www.regulations.gov. In addition, once the Bureau’s headquarters reopens, comments will be available for public inspection and copying at 1700 G Street NW, Washington, DC 20552, on official business days between the hours of 10 a.m. and 5 p.m. Eastern Time. At that time, you can make an appointment to inspect the documents by telephoning 202-435-9169. All comments, including attachments and other supporting materials, will become part of the public record and subject to public disclosure. Proprietary information or sensitive personal information, such as account numbers or Social Security numbers, or names of other individuals, should not be included. Comments will not be edited to remove any identifying or contact information. FOR FURTHER INFORMATION CONTACT: Gary Stein, Office of Consumer Credit, Payments, and Deposits Markets at 202-435-7700; or Will Wade-Gery, Office of Innovation, at [email protected] or 202-435-7700. If you require this document in an alternative electronic format, please contact [email protected]. SUPPLEMENTARY INFORMATION: The Bureau is issuing this ANPR to solicit comments and information to assist the 2 Bureau in developing regulations to implement section 1033 of the Dodd-Frank Act (section 1033), which provides for consumer access to financial records. The Bureau is issuing this ANPR to solicit stakeholder input on ways that the Bureau might effectively and efficiently implement the financial record access rights described in Section 1033, recognizing that various market participants have helped authorized data access become more secure, effective, and subject to consumer control. While the Bureau expects these trends to continue, there are indications that some emerging market practices may not reflect the access rights described in section 1033. The Bureau is also seeking information regarding the possible scope of data that might be made subject to protected access, as well as information that might bear on other terms of access, such as those relating to security, privacy, effective consumer control over access and accessed data, and accountability for data errors and unauthorized access. The Bureau is also interested in comment on whether and how issues of potential regulatory uncertainty with respect to section 1033 and its interaction with other statutes within the Bureau’s jurisdiction, such as the Fair Credit Reporting Act, may be impacting this market to the potential detriment of consumers, and seeks information that may help resolve such uncertainty. The Bureau invites comment on all aspects of this ANPR from all interested parties, including consumers, consumer advocacy groups, industry members and trade groups, and other members of the public. This ANPR proceeds in five sections. Section I summarizes the Dodd-Frank Act’s description of consumer rights to access financial records. Section II provides defined terms for the ANPR. Section III provides an overview of data access, with a particular focus on the authorized data access ecosystem, including the players involved, modes of access, competitive incentives and standard-setting, and consumer impacts. Section IV summarizes the Bureau’s actions to date relating to consumer-authorized data access. Section V includes a series of 3 questions about whether and how the Bureau might most effectively provide regulatory guidance in this area. As discussed in greater detail in section IV, the Bureau has taken several steps with respect to section 1033, including extensive engagement with stakeholders from a range of perspectives. These include a request for information issued in 2016, a Bureau statement of principles in 2017, and most recently, a February 2020 symposium. The valuable information and comments the Bureau has received through its stakeholder engagement efforts informs section III’s discussion of the complex issues raised with respect to effective implementation of section 1033 and the section V questions intended to assist Bureau decisions concerning potential rulemaking. I. Section 1033 Section 1033 is comprised of five subsections. Section 1033(a) provides that, subject to rules prescribed by the Bureau, a covered person shall make available to a consumer, upon request, information in the control or possession of the covered person concerning the consumer financial product or service that the consumer obtained from such covered person, including information relating to any transaction, series of transactions, or to the account including costs, charges and usage data.1 The information is to be made available in an electronic form usable by consumers. Section 1033(b) then outlines certain exceptions from these general access rights. For example, a covered person may not be required to make available to the consumer 1 Section 1002 of the Dodd-Frank Act defines certain terms used in section 1033. Section 1002(4) defines a “consumer” as “an individual or an agent, trustee, or representative acting on behalf of an individual.” 12 U.S.C. 5481(4). Section 1002(5), by incorporation, provides a multi-part definition of “consumer financial products or services.” See 12 U.S.C. 5481(5). Finally, section 1002(6) defines “covered persons,” in part, as entities engaged in offering or providing consumer financial products or services. See 12 U.S.C. 5481(6). 4 “confidential commercial information, including an algorithm used to derive credit scores or other risk scores or predictors” and “information that the covered person cannot retrieve in the ordinary course of its business with respect to that information.”2 Section 1033(c) establishes that section 1033 does not “impose any duty on a covered person to maintain or keep any information about a consumer.”3 Section 1033(d) states that “[t]he Bureau, by rule, shall prescribe standards to promote the development and use of standardized formats for information, including through the use of machine readable files, to be made available to consumers under this section.”4 Finally, section 1033(e) requires that the Bureau consult with the Board of Governors of the Federal Reserve System, the Office of the Comptroller of the Currency (OCC), the Federal Deposit Insurance Corporation, and the Federal Trade Commission to ensure, to the extent appropriate, that any rule pursuant to section 1033 imposes substantively similar requirements on covered persons, takes into account conditions under which covered persons do business both in the United States and in other countries, and does not require or promote the use of any particular technology in order to develop systems for compliance.5 II. Definitions This ANPR relies upon several terms defined in the Dodd-Frank Act. For convenience, this ANPR also defines several additional terms. The non-statutorily defined terms in this ANPR 2 See 12 U.S.C. 5533(b)(1) and (4). 3 12 U.S.C. 5533(c). 4 12 U.S.C. 5533(d). 5 See 12 U.S.C. 5533(e). The Bureau works with other regulators on innovation matters through various means. For example, the Bureau and the OCC recently convened virtual innovation office hours so that participants would have an opportunity to discuss issues that touch upon both consumer protection and prudential regulation. See https://www.consumerfinance.gov/about-us/newsroom/cfpb-occ-host-virtual-innovation-office-hours/. 5 are for purposes of this ANPR only and should not be understood to indicate any legal interpretation, legal guidance, or policy judgment by the Bureau. When specific questions in section V below depart from these definitions,